司法部国际行动清除Gootloader恶意软件：逾100台服务器被清理，该软件曾感染至少2.5万台电脑
美国司法部（DOJ）11月12日宣布，在一项国际执法行动中，执法人员已从100多台计算机服务器上清除名为「Gootloader」的恶意软件，并查封了犯罪分子用来分发和控制该软件的美国域名。这些服务器包括被入侵的 WordPress 网站。
司法部表示，Gootloader 自2018年以来已在全球感染至少2.5万台电脑，并被用于针对至少44名美国受害者的勒索软件攻击，造成约2880万美元损失。该软件的攻击目标还包括美国战争部和国防工业基础部门。
司法部刑事司助理部长 A. Tysen Duva 说，经法院授权，司法部和联邦调查局（FBI）与国际伙伴一道开展了这次在线行动，把100多台服务器从恶意软件手中解放出来，让勒索软件犯罪分子失去了一个作案平台。科罗拉多区联邦检察官 Peter McNeilly 说，网络犯罪没有国界，此案正是国际伙伴协作为全球民众提供保护的例证。
根据本周启封的搜查令，Gootloader 常以诱骗用户下载文件的方式感染电脑，受感染的电脑会被编入由其他受感染电脑组成的僵尸网络，操控者再进一步感染更多电脑，并把这些电脑的访问权限卖给勒索软件团伙。
这次行动与名为「终局行动」（Operation Endgame）的跨国执法倡议协调进行，该倡议专门打击为网络犯罪提供服务的恶意软件基础设施。调查由美国战争部监察长办公室国防刑事调查局（DCIS）、FBI 丹佛外勤办公室和陆军刑事调查局牵头，德国、荷兰、加拿大、丹麦、法国、英国、澳大利亚等国执法机构以及 Europol 参与。Shadowserver 基金会协助联系互联网服务提供商和计算机安全事件响应团队，识别受感染系统、通知受害者并协助修复。
案件由司法部刑事司计算机犯罪与知识产权科高级律师 Thomas Dougherty 与科罗拉多区助理联邦检察官 Jasand Mock 负责起诉，司法部国际事务办公室提供协助。（来源：美国司法部）
DOJ-led international operation disrupts Gootloader malware: more than 100 servers cleaned, at least 25,000 computers infected
The U.S. Department of Justice (DOJ) announced on November 12 that, in an international law enforcement operation, officers had removed malware known as Gootloader from more than 100 computer servers, including compromised WordPress sites, and seized U.S. domain names used by criminals to deliver and control the malware.
Since 2018, Gootloader has infected at least 25,000 computers around the world and has been used in ransomware attacks on at least 44 U.S.-based victims, resulting in approximately $28.8 million in losses, the department said. Its targets included the U.S. Department of War and the Defense Industrial Base.
Assistant Attorney General A. Tysen Duva of the Justice Department's Criminal Division said that, with court authorization, the department and the FBI, along with international partners, conducted an online operation that liberated more than 100 servers from malicious software, denying ransomware criminals a platform. U.S. Attorney Peter McNeilly for the District of Colorado said cybercrime knows no borders and called the case an example of international partnerships protecting people around the world.
According to warrants unsealed this week, Gootloader infects computers by tricking users into downloading it. Infected computers are added to a botnet of other compromised machines, which the operators use to infect still more computers and then sell access to those machines to ransomware actors.
The actions were conducted in coordination with Operation Endgame, a multinational initiative targeting malware services used by cybercriminals. The investigation was led by the Defense Criminal Investigative Service (DCIS), the FBI's Denver Field Office and the Army Criminal Investigation Division, working with law enforcement in Germany, the Netherlands, Canada, Denmark, France, the United Kingdom and Australia, and with Europol. The Shadowserver Foundation assisted internet service providers and computer security incident response teams in identifying infected systems, notifying victims and helping with remediation.
Senior Counsel Thomas Dougherty of the Criminal Division's Computer Crime and Intellectual Property Section and Assistant U.S. Attorney Jasand Mock for the District of Colorado are prosecuting the case, with assistance from the Justice Department's Office of International Affairs. (Source: U.S. Department of Justice)
来源：美国司法部
发布：GSM·美国（发布链接）
图片来源：图：美国司法部总部大楼（华盛顿，资料图）。四级图库联邦核心包，司法部大楼固定图。 / Photo: U.S. Department of Justice headquarters building in Washington (file photo). Federal core asset pack.
GSM Global · 本篇英文版 English edition of this story
